Open Bug Bounty selected among the
Top 5 Bug Bounty programs to watch
in 2021 by The Hacker News

For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,202,879 coordinated disclosures
811,946 fixed vulnerabilities
1,571 bug bounty programs, 3,122 websites
27,908 researchers, 1,427 honor badges

Amberlo Bug Bounty Program

Amberlo runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Amberlo

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Amberlo and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

test.amberlo.io

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

We have created Amberlo to provide better access to justice. Like any other technology, Amberlo is not perfect. Therefore we aim to work with the leading security researchers worldwide to strengthen Amberlo app security.

Please inform us about any security issues, and we will make sure that we fix them promptly in collaboration with you.

While researching, we'd like to ask you to avoid the following:
* Denial of service attacks
* Spamming
* Social engineering (including phishing) of Amberlo staff or contractors
* Any physical attempts against Amberlo property or data centers

Thank you for helping keep the Amberlo app and our users safe!

Testing Requirements:

We have mirrored our production environment and created new environment for testing at test.amberlo.io. Please use test.amberlo.io while researching, but try to avoid anything that would result in an extreme load on the prepared test environment.

Possible Awards:

Amberlo offers a monetary bounty for reports of qualifying security vulnerabilities. Reward amounts will vary based on the severity of the reported vulnerability and agreed upon case by case.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

tusharSharma_0     5 June, 2021
    tusharSharma_0:
What's the email for reporting??
ajaysenr     28 January, 2021
    ajaysenr:
Thanks Team for the reward and quick response, Appreciate it.
B19R8A14     25 January, 2021
    B19R8A14:
hello, i have reported the vulnerability via email please check
shankarvemula01     21 January, 2021
    shankarvemula01:
HELLO TEAM,

I AM REPORTING VIA EMAIL THAT SUPPORTMAILS

PLEASE CHECK EMAILS FROM SHANKARSECU

  Latest Patched

 16.05.2022 baclieu.gov.vn
 16.05.2022 essuir.sumdu.edu.ua
 16.05.2022 westerncape.gov.za
 16.05.2022 mobilecentre.am
 16.05.2022 e-store.bluebrand.me
 16.05.2022 jic.edu.sa
 16.05.2022 faculdadefacit.edu.br
 16.05.2022 dochkisinochki.ru
 16.05.2022 uner.edu.ar
 16.05.2022 trangnguyen.edu.vn

  Latest Blog Posts

15.02.2022 by sepkatpro
Ultimate XSS Polyglot
11.11.2021 by mistry4592
The Most used Chrome Extensions are Used For Penetration Testing.
08.10.2021 by NNeuchi
How I Found My First Bug Reflected Xss On PIA.GOV.PH(Philippine Information Agency)
26.08.2021 by PyaePhyoThu98
eG Manager v7.1.2: Improper Access Control lead to Remote Code Execution (CVE-2020-8591)
14.07.2021 by Open Bug Bounty
Interview With Open Bug Bounty

  Recent Recommendations

@notedekd     28 April, 2022
    Twitter notedekd:
@singhnitesh21 provides precise and comprehensive vulnerable information. I highly appreciate the support and quick response.
@CERT_rlp     27 April, 2022
    Twitter CERT_rlp:
The team of CERT-rlp would like to thank Antonio for a responsible and coordinated disclosure of vulnerabilities
@DeanHalter     25 April, 2022
    Twitter DeanHalter:
Appreciate the skill and effort Nitesh and others in the open bounty, ethical hacker community bring to the table. He pointed out an XSS vulnerability on our website.
@TiagoGuedesEGo1     22 April, 2022
    Twitter TiagoGuedesEGo1:
Pranjal made us aware of several security vulnerabilities that represented security flaws of several degrees and needed to be rectified.

It was a pleasure working with him and I hope we can work again in the future, Thank you!
@DeanHalter     20 April, 2022
    Twitter DeanHalter:
Thank you for reporting the pair of XSS issues you found on our site. Your expertise and ethical reporting/handling helped us secure our website. Keep up the great and necessary work.